CVE-2026-23391

Vulnerability

Overview

CVE-2026-23391 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the xt_CT module. The root cause is that when a netfilter template rule is removed, any packets that are still enqueued in the nfqueue and reference that template are not flushed. These packets hold pointers to associated objects such as a connection tracking helper (which could be unloaded) or a timeout policy (which could be removed via nfnetlink_cttimeout_cttimeout). The template removal does not wait for or cancel these pending references, leaving dangling pointers that can be dereferenced after the objects are freed [1][2].

Exploitation

Conditions

An attacker must have the ability to create and remove a netfilter template rule while packets are still queued in the nfqueue. This typically requires local access with sufficient privileges to modify netfilter rules (e.g., root or CAP_NET_ADMIN). The vulnerability is triggered when a helper module is unloaded or a timeout policy is deleted while packets referencing the template remain in the nfqueue. No special network position is needed beyond the ability to trigger the rule removal [3][4].

Impact

If successfully exploited, an attacker could cause a use-after-free condition, leading to a kernel crash (denial of service) or potentially arbitrary code execution in kernel context. The CVSS v3 score of 7.8 (High) reflects the high impact on confidentiality, integrity, and availability, though exploitation requires local access and elevated privileges.

Mitigation

The fix is included in the Linux kernel stable branches as commits [1], [2], [3], and [4]. Users should update to a kernel version containing these patches. No workaround is available; the vulnerability is resolved by ensuring that all enqueued packets are flushed when a template rule is removed.